Security device for ring network

Abstract

A ring data network (such as a token ring network) is divided by a security unit (1) into first and second segments (6 and 8). The second segment (8) typically corresponds to one security group in the network. Logic in the security unit reads appropriate parts of each frame (typically the two address segments) to determine whether it is appropriate to forward the frame to the next segment of the ring. If the frame does not need to go to the next segment, or is not authorized to do so, then the security unit forwards instead a modified form of the frame in which its data cannot be read (except possibly by the security unit itself). In most cases the data content of the frame will be stored in the security unit. When the modified frame returns to the security unit at its second input port (4), the original frame can (if appropriate) be reconstructed, typically by reading its data content from a store in the security unit. In this way, the frame is returned to the secure group at the same time and in the same form as if it had travelled around the first segment of the ring, but there is no opportunity for stations in the first segment to eavesdrop upon the frame.

I claim: 
     
       1. A security unit for a ring network having two pairs of ports, each pair comprising an input port for receiving data frames from the ring and an output port for forwarding data frames to the ring, so that it may be connected into the ring in two positions so as to divide the ring into a first segment downstream of the first pair of ports and a second segment downstream of the second pair of ports, each said segment containing at least one station, characterized by means for reading a part of a received data frame received at the input port of the first pair and determining in response to that part of the received data frame whether the received data frame is addressed to and/or authorized to be received by a station in the first segment; means for modifying the received data frame into a modified frame having a form in which data content of the received frame cannot be read and for forwarding the modified frame to the first output port of the first pair, instead of the received data frame, if it is not addressed to a station in the first segment or is not authorized to be received by a station in the first segment; and means for reconstructing the received data frame and transmitting the received data frame from the output port in the second pair when the modified frame is returned to the security unit by a station in the first segment. 
     
     
       2. A security unit as claimed in claim 1, including a memory and, in which the means for modifying modifies received frames by substituting some other data for all or at least a major part of the data contained in the received data frame while holding at least the data contained in the received data frame in the memory in the security unit; and the means for reconstructing restores the received data frame when required by reading from the memory. 
     
     
       3. A security unit as claimed in claim 2, the second segment of the ring constituting a single security group and in which frames addressed by one station in the security group to another station in the security group are modified by the security unit before being transmitted to the first segment of the ring. 
     
     
       4. A security unit as claimed in claim 3 in which the received data frame includes a destination address and the security unit reads the destination address of each received data frame at the input port of the first pair, compares the destination address with stored data identifying the station (s) connected to the first segment of the ring and forwards the received data frame if the destination address of the frame matches a stored address but otherwise forwards a modified frame. 
     
     
       5. A security unit as claimed in claim 3 in which the received data frame has a destination address and a source address, and the security unit reads both the destination address and the source address of each received data frame at the input port of the first pair and compares the destination address and the source address with stored data identifying stations connected to the first segment of the ring and in which the received data frame is forwarded by the output port of the first pair if either the destination address or the source address matches a station connected to the first segment of the ring but otherwise a modified frame is forwarded. 
     
     
       6. A security unit as claimed in claim 3 in which the received data frame has a destination address and a source address, and the security unit reads both the destination address and the source address of each received data frame and compares the destination address and the source address with the access rules indicating which sources are authorized to communicate with the station or stations connected to the first segment of the ring. 
     
     
       7. A security unit as claimed in claim 3 in which either or both of the first and the second segments are sub-divided by additional security units as aforesaid. 
     
     
       8. A security unit as claimed in claim 1 in which the first and second segments include a single station. 
     
     
       9. A security unit in claim 8 in which the received data frame includes a destination address and the security unit reads the destination address of each received data frame at the input port of the first pair, compares the destination address with stored data identifying the station connected to the first segment of the ring and forwards the received data frame if the destination address of the frame matches a stored address but otherwise forwards a modified frame. 
     
     
       10. A security unit as claimed in claim 8 in which the received data frame includes a destination address and a source address, and the security unit reads both the destination address and the source address of each received data frame at the input port of the first pair and compares the destination address and the source address with the access rules indicating which sources are authorized to communicate with the station connected to the first segment of the ring. 
     
     
       11. A security unit as claimed in claim 9 in which the received data frame has a destination address and a source address, and the security unit reads both the destination address and the source address of each received data frame and compares the destination address and the source address with the access rules indicating which sources are authorized to communicate with the station connected to the first segment of the ring. 
     
     
       12. A security unit for a ring network having two pairs of ports, each pair comprising an input port for receiving data frames from the ring and an output port for forwarding data frames to the ring, so that it may be connected into the ring in two positions so as to divide the ring into a first segment downstream of the first pair of ports and a second segment downstream of the second pair of ports, each said segment containing at least one station, characterized by a memory, means for reading a part of a received data frame received at the input port of the first pair and determining in response to that part of the frame whether the received data frame is addressed to and/or authorized to be received by a station in the first segment; means for modifying the received data frame in to a modified frame having a form in which data content of the received data frame cannot be read and for forwarding the modified frame to the output port of the first pair, instead of the received data frame, if it is not addressed to a station or is not authorized to be received by a station in the first segment; means for reconstructing the received data frame and transmitting the received data frame from the output port of the second pair when the modified frame is returned to the security unit by a station in the first segment and wherein the means for modifying modifies received data frames by substituting some other data for all or at least a major part of the data contained in the received data frame while holding at least the data contained in the received data frame in the memory in the security unit, and the means for reconstructing restores the received data frame when required by reading from the memory. 
     
     
       13. A security unit as claimed in claim 12, the second segment of the ring constituting a single security group and in which frames addressed by one station in the security group to another station in the security group are modified by the security unit before being transmitted to the first segment of the ring. 
     
     
       14. A security unit as claimed in claim 12 in which either or both of the first and the second segments are sub-divided by additional security units as aforesaid. 
     
     
       15. A security unit as claimed in claim 12 in which the first and second segments include a single station. 
     
     
       16. In a token ring local area network having at least one central controller with at least one port, each port coupling to a user station, a method for securing data on the network comprising the steps of: (a) receiving, at a port, a data packet from the ring having at least a destination address, a source address, and a data field;   (b) storing a content of said data field at said port;   (c) examining a security qualifier portion of said data packet to determine whether said data packet is to be secured;   (d) generating a substitute bit pattern; and   (e) replacing said data field content with said substitute bit pattern to form a secured data packet in response to said examining step.   
     
     
       17. The method for securing data on a local area network as recited in claim 16, wherein said security qualifier portion of said data packet is said destination and source addresses, said examining step comparing said destination and source addresses with an address of a station attached to said port. 
     
     
       18. The method for securing data on a local area network as recited in claim 16, wherein said security qualifier portion of said data packet comprises said destination address. 
     
     
       19. The method of securing data on a local area network as recited in claim 16, further comprising the step of transmitting said data packet unaltered if said data packet comprises a management frame. 
     
     
       20. The method of securing data on a local area network as recited in claim 16 further comprising the steps of: (f) transmitting said secured data packet to an attached user station;   (g) receiving back at said port said secured data packet from said attached user station;   (h) replacing said substitute bit pattern with said content of said data field stored at step (b) to form a restored data packet; and   (i) transmitting said restored data packet onto the ring.   
     
     
       21. In a token ring local area network having at least one central controller with at least one port, each port coupling to a user station, a method for securing data on the network comprising the steps of: (a) receiving at a port a data packet from the ring having at least a destination address, a source address, and a data field;   (b) storing a content of said data field at said port;   (c) comparing said destination and said source address with an address of a station attached to said port;   (d) generating a substitute bit pattern; and   (e) replacing said data field content with said substitute bit pattern to form a secured data packet if said source or destination address does not match said address of said attached station.   
     
     
       22. The method for securing data on a local area network as recited in claim 21 further comprising the steps of: (f) transmitting said secured data packet to said attached station;   (g) recovering said data packet by inserting said stored data field content in place of said substitute bit pattern in a data packet received from said station; and   (h) transmitting said recovered data packet to a next port on said ring.   
     
     
       23. The method for securing data on a local area network as recited in claim 21, wherein said storing step stores said content of said data field in a first-in first-out fashion at a memory structure at said port. 
     
     
       24. In a central controller of a token ring local area network, a port circuit for providing data security on the network, comprising: storage means coupled to receive from the ring a data packet having user data;   pattern detection means, coupled to receive from the ring a data packet having user data, said pattern detection means for comparing a destination and a source address of said data packet with an address of a station attached to the port;   pattern generator means for generating a substitute data pattern; and   selection means, coupled to receive said data packet and coupled to said pattern generator means and said pattern detection means, for selecting said substitute data pattern to be transmitted to said station attached to the port if said data packet destination or source address does not match said station address.   
     
     
       25. A port circuit as recited in claim 24 further comprising: second selection means, coupled to receive a data packet from said station attached to the port and coupled to said storage means, for selecting a contents of said storage means to be transmitted to a next station if said data packet includes said substitute data pattern.   
     
     
       26. In a central controller of a token ring local area network, a port circuit for providing data security on the network, comprising: a pattern detector having an input for receipt from the ring of a data packet having user data and having an output, said pattern detector for comparing a destination and a source address of said data packet with an address of a station attached to the port;   storage means coupled to receive said data packet for storing said data packet;   a pattern generator for generating a substitute data pattern;   a first multiplexer having a first input for receipt of said data packet and a second input coupled to an output of said pattern generator, and a control input coupled to an output of said pattern detector, and an output coupled to said station attached to the port; and   a second multiplexer having a first input coupled to an output of said storage means, a second input coupled to receive transmit data from said station attached to the port, a control input coupled to said output of said pattern detector, and an output coupled to the ring.